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Abstract — Imperfect secrecy in communication systems is 
investigated. Instead of using equivocation as a measure of 
secrecy, the distortion that an eavesdropper incurs in producing 
an estimate of the source sequence is examined. The commu- 
nication system consists of a source and a broadcast (wiretap) 
channel, and lossless reproduction of the source sequence at 
the legitimate receiver is required. A key aspect of this model 
is that the eavesdropper's actions are allowed to depend on the 
past behavior of the system. Achievability results are obtained 
by studying the performance of source and channel coding 
operations separately, and then linking them together digitally. 
Although the problem addressed here has been solved when 
the secrecy resource is shared secret key, it is found that 
substituting secret key for a wiretap channel brings new insights 
and challenges: the notion of weak secrecy provides just as much 
distortion at the eavesdropper as strong secrecy, and revealing 
public messages freely is detrimental. 

I. Introduction 

There are a variety of ways to model the presence of 
secrecy in a communication system. Shannon considered 
the availability of secret key shared between the transmitter 
(Alice) and receiver (Bob), using it to apply a one-time pad 
to the message [1]. Wyner introduced the idea of physical- 
layer security with the wiretap channel and secrecy capacity, 
exploiting the difference in the channels to Bob and Eve (the 
eavesdropper) [2|. Maurer derived secrecy by assuming that 
Alice, Bob, and Eve have access to correlated random vari- 
ables [3j. In such models, the measure of security is usually 
the conditional entropy, or "equivocation", of the message; 
maximum equivocation corresponds to perfect secrecy. 

In this work, we replace equivocation with an opera- 
tionally motivated measure of secrecy. We want to design 
our coding and encryption schemes so that if Eve tries to 
reproduce the source sequence, she will suffer a certain level 
of distortion. More precisely, the measure of secrecy is the 
minimum average distortion attained by the cleverest (worst- 
case) eavesdropper. Occasionally, we will refer to Eve's 
minimum average distortion as the payoff: Alice and Bob 
want to maximize the payoff over all code designs. 

This measure of secrecy has been considered previously by 
Yamamoto in [4|, but our setup differs from H in a few ways, 
the most salient of which is "causal disclosure". We assume 
Bob, the legitimate receiver, is producing actions that are 
revealed publicly (in particular, to Eve) in a causal manner. 
We might view Eve as an adversary who is trying to predict 
Bob's current and future actions based on both the actions 
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Fig. 1. Joint source-channel operations. Bob and Eve produce the sequences 
S n and T n , respectively, after they receive the broadcast channel outputs. In 
the ith step, Bob produces Si , and Eve produces T; based on her observation 
of Z n and S*' 1 . 



that she has already witnessed and the output of her wiretap, 
and subsequently act upon her predictions (see Figure Q}. 

To further motivate the causal disclosure feature of our 
model, consider the effect of removing it; that is, consider Ya- 
mamoto's problem in [4|. Alice must communicate a source 
sequence losslessly to Bob over a noiseless channel and 
the secrecy resource is shared secret key. Eve observes the 
message but is not given causal access to Bob's reproduction 
sequence. As shown in 0, the solution to this problem is 
that any positive rate of secret key is enough to cause Eve 
unconditionally maximal distortion - we see that secrecy is 
alarmingly inexpensive. Similarly, if the secrecy resource is 
physical-layer security instead of shared secret key, it can 
be shown that a positive secrecy capacity is enough to force 
maximal distortion. However, with causal disclosure in play 
a tradeoff between secrecy capacity and payoff emerges. As 
a side remark, one might observe that causal disclosure is 
consistent with the spirit of Kerckhoffs's principle J6). 

In addition to assuming causal disclosure, we further 
diverge from |4) by considering the presence of a wiretap 
channel instead of shared secret key; the problem of shared 
secret key with causal disclosure was solved in Q. In Q, it 
was found that the optimal tradeoff between the rate of secret 
key and payoff earned is achieved by constructing a message 
that effectively consists of a fully public part and a fully 
secure part. More specifically, the optimal encoder publicly 
reveals a distorted version of the source sequence and uses 
the secret key to apply a one-time pad to the supplement. 
With this insight, we use the broadcast channel to effectively 
create two separate channels - one public and one secure - 



as is done in JSJ- However, we modify [8| by removing 
the requirement that Eve must decode the public message, 
thereby rendering the message public only in intention, not 
in reality. We show that freely giving the "public" mes- 
sage away dramatically decreases Eve's distortion; thus, her 
equivocation of the public message becomes important. Upon 
using channel coding to transform the broadcast channel into 
effective public and secure channels, we show that the weak 
secrecy provided by the channel encoder allows us to use the 
source code from [7| to link the source and channel coding 
operations together digitally. It turns out that a strong secrecy 
guarantee would not improve the results. Separation allows 
us to obtain a lower bound on the achievable payoff. We also 
provide an example of the lower bound and obtain an upper 
bound. Most of the proofs are omitted. 

Before proceeding, we briefly juxtapose our measure of 
secrecy with equivocation. Equivocation does not give much 
insight into the structure of Eve's knowledge and does not 
depend on the actions that Eve makes. In contrast, looking at 
Eve's distortion tells us something about the quality of her 
reconstruction if her aim is to replicate a source sequence and 
produce actions accordingly. There are other instances in the 
literature where an operational definition of security is used. 
For example, in [9], Merhav et al. looked at the expected 
number of guesses needed to correctly identify a message. 

II. Problem Statement 

The system under consideration, shown in Figure Q] op- 
erates on blocks of length n. All alphabets are finite, and 
both the source and channel are memoryless. The commu- 
nication flow begins with Alice, who observes a sequence 
S n , i.i.d. according to P$, and produces an input X n to 
the broadcast channel. The memoryless broadcast channel is 
characterized by Py,z\x> but since the relevant calculations 
only involve the marginals Py\x an d Pz\X> we need only 
consider Py,z\x = Py\xPz\x- At one end of the channel, 
Bob receives Y n and generates a sequence of actions, S n , 
with the requirement that the block error probability be small. 
At the other terminal of the channel, Eve receives Z" and 
generates T n ; in generating Tj, she has access to the full 
Z n sequence and the past actions of Bob, S t ~ 1 . In essence, 
we can view Bob and Eve as playing a public game that 
commences after they receive the channel outputs. In each 
move, they are allowed to see each other's past moves and 
produce an estimate of the next source symbol accordingly. 
Since Bob's reproduction must be almost lossless, his moves 
are restricted and he does not benefit from knowing Eve's 
past actions. For similar reasons, revealing S 1 ^ 1 to Eve at 
step i has exactly the same consequences as revealing S l ~ 1 ; 
henceforth, we consider the causal disclosure to be A 
more general version of the game would allow for distortion 
in Bob's estimate (see ifTOl ). but in this work we focus on 
lossless communication. 

In the next two definitions, refer to Figure Q] for an 
illustration of the setup. 



Definition 1. For blocklength n, a source-channel code 
consists of an encoder f and a decoder g: 

f : S" — > X n (more generally, P x ™\s n ) 

g -.y n -> S n . 

Note that we do not restrict the encoder to be deterministic. 

For any source-channel code, we can calculate the proba- 
bility of block error and the payoff earned against the worst- 
case adversary, as defined in the following: 

Definition 2. Fix a value function (or, distortion measure) 
7r:5xT-> [0, oo). We say that a payoff II is achievable if 
there exists a sequence of source-channel codes such that 
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Eve's average distortion, i.e. the LHS of Q, is defined 
exactly as in rate-distortion theory for separable distortion 
measures. Although it is not explicit in (O, we assume that 
Eve has full knowledge of the source-channel code and the 
source distribution Ps- 

III. Lower Bound 

The first result is a lower bound on the maximum achiev- 
able payoff. 

Theorem 1. Fix Ps, Py.z\x, an d 7r(s, i). A payoff IT is 
achievable if the inequalities 

I(S-U) < I(V-Y) 
H(S\U) < I(W; Y\V) - I(W; Z\V) 
n < min E[?r(5, t{U))] 

t(u) 

hold for some distribution PsPu\S Pv P\v\v Px\w Py,z\x- 

Theorem[T]is obtained in part by transforming (via channel 
coding) the noisy broadcast channel into noiseless public and 
secure channels. However, the result can be strengthened 
considerably by taking into account Eve's equivocation of 
the public message. The source-channel code used to achieve 
Theorem [T] remains the same; only the analysis is strength- 
ened. We illustrate and discuss this further in section |IV] 
where we give a brief proof sketch. Our main result is the 
following theorem. 

Theorem 2. Fix Ps, Py,z\x, an d ir(s,t). A payoff H is 
achievable if the inequalities 

I(S; U)<I{V;Y) 

H(S\U) < I(W; Y\V) - I{W] Z\V) 

n < a ■ n max + (1 - a) ■ minE[7r(S, t(U))} 

t(u) 
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Fig. 2. Channel coding operations. 



hold for some distribution Ps Pjj\sPv P\v\v Px\w Py,z\x> 
where 

n max = minE[7r(5,t)] 



and 



[I(V;Y)-I(V;Z)}+ 



I(S; U) 

We obtain the lower bound in Theorem [2] by concatenating 
a source code and a channel code and matching the rates 
of the two codes. We first describe what constitutes a good 
channel code, and the secrecy guarantees that come with it. 

A. Channel Code 

The channel code is made up of an encoder and decoder 
as shown in Figure |2] The input to the encoder is a pair of 
messages (M p ,M s ) destined for the channel decoder, with 
M p representing a public message and M s a secure message. 
The channel decoder outputs the pair (M p ,M s ). We allow 
the channel encoder to use private randomization. 

Definition 3. A (R p , R s ,n) channel code consists of a 
channel encoder f c and channel decoder g c : 

fc ■ M p x M s -> X n (more generally, Px™\m p ,mJ 
g c '-y n -> M p x M s , 
where \M P \ = 2 nR » and \M S \ = 2 nR °. 

Keeping in mind criteria (Q~|i and (O and our desire to form 
public and private channels, we might ask: what constitutes 
a good channel code? First, the legitimate channel decoder 
must recover M p and M s with vanishing probability of 
error. Second, we need a guarantee that we have indeed 
created a private channel. Ideally, we want to guarantee 
that the a priori distribution on M s matches the a pos- 
teriori distribution given both Z n and M p . If this holds, 
we are assured that even if the adversary is able to view 
the public channel perfectly (i.e., recover M p ), his optimal 
strategy for determining M s is to choose a random message 
according to the a priori distribution Pm s - Later we will 
exploit the adversary's inability to exactly recover M p , but 
for now we suppose that it is freely available. We turn 
to the notion of secrecy capacity and cast our requirement 
in terms of entropy: we want H(M S ) ps H(M s \Z n , M p ), 
or I(M s ;Z n ,M p ) ps 0. More precisely, the normalized 
mutual information -I(M S ; Z n , M p ) should vanish in a good 
channel code. Although this measure of secrecy is so-called 
"weak secrecy", it turns out that having strong secrecy would 
not improve the payoff for the source encoder that we use. 



We make a further technical requirement (c.f. |8|) that 
good channel codes must satisfy for our purposes, consider- 
ing the particular source encoder that we employ. The channel 
code must work not only for (M p , M s ) independent and 
uniformly distributed, but more generally in the case that, 
conditioned on M p , M s is almost uniform. To be precise, 
we require 



P[M S = m s \Mp = m p } s 

IIleLX r . ~ _^ z 

m p ,ms,ni ! s ¥[M S — 171 s \ M p — m p \ 



(3) 



to hold for some 6 n such that S n — > as n — > oo. 
The source encoder we employ will produce message pairs 
(Mp, M s ) that satisfy this condition, regardless of the source 
distribution. 

Definition 4. The pair of rates (R pi R s ) is achievable if 
for all (M p ,M s ) satisfying (0 for every n, there exists a 
sequence of (R p , R s , n) channel codes such that 



lim ¥[(Mp,M s ) ^ (Mp,M s )} = 



and 



lim -I(M s ;Z n ,M p ) 

n— >oo n 



0. 



The following theorem gives an achievable region, the 
proof of which comes from modifying the work done in 
[8 |. The idea is to include enough private randomness in the 
channel encoder so that the adversary effectively uses his full 
decoding capabilities to resolve the randomness, leaving no 
room to additionally decode part of the secret message. The 
amount of randomness required is the mutual information 
provided by the adversary's channel. 

Theorem 3. The pair (R pi R s ) is achievable if 

Rp <I(V; Y), 

R s <I(W;Y\V)-I(W;Z\V) 
for some PvPw\v p x\wPy z\x- 
B. Source Code 

A source code consists of a source encoder and decoder. 
The encoder observes a memoryless source P$ and produces 
a pair of messages, (M p , M s ), with M p representing a public 
message and M s a secure message. We allow the source 
encoder to use private randomization. 

Definition 5. A (R pi R s ,n) source code consists of an 
encoder f s and a decoder g s : 

fs ■ S n -> M p x M s (more generally, P Mp ,M B \S™) 
g s : M p x Ms -> S n , 

where \M P \ = 2 nR p and \M S \ = 2 nRs - 

As shown in Figure [3] the output of the source encoder is 
effectively passed through a channel p z^\M ,M S - I n light of 
the previous subsection, we want to consider sequences of 
channels {Pz™\m p ,m b },?=i that provide weak secrecy when 
the output of the source encoder satifies ©. 
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Fig. 3. Source coding operations. 

Definition 6. Define Cg to be the set of {Pz™\m ,m 3 }"^Li 
such that, for all Pm p .m s satisfying (O for every n, 

-I(M s ;Z n \M p )^0. 

n 

We can view Cs as the resource of physical-layer security. 
Notice that a sequence of good channel codes yields a 
sequence of channels in Cs to the adversary. We now 
consider what payoff can be achieved if rates are imposed 
on the messages, and Cs is imposed. By considering the 
availability of a structure Cs and a noiseless channel from 
Alice to Bob, we are effectively divorcing the goals of source 
and channel coding so that each can be considered separately. 

Definition 7. Fix Ps and n(s,t). The triple (R p , R S ,H) is 
achievable if there exists a sequence of (R p , R s ,n) source 
codes such that 



lim V[S n ^ S n ] = 0, 

n— too 

(M p ,M s ) satisfies ® Vn, 
and, for all {P z »\m v ,mJ%Li € Cs, 



(4) 
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lim min E 

n->oo {tils 1 - 1 ,z n )}i 
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-5>(^(s 4 -\z")) 



> n. 



(6) 



We give a region of achievable (R p , R S ,H). In [7|, the 
region is characterized when the secrecy resource is shared 
secret key instead of physical-layer security. 

Theorem 4. Fix Ps and tt(s, t). Then {R p , R s , II) is achiev- 
able if the inequalities 

R p > I(S; U) 
R s > H(S\U) 
IT < imixEM S,t(U))] 

t(u) 

hold for some PsPjj\s- 

The lower bound in Theorem Q] follows from Theorems [3] 
and |4] The main idea in the proof of Theorem |4] is to 
use the public message to specify a sequence U" that is 
correlated with S n , and use the secure message to encode 
the supplement that is needed to fully specify the source 
sequence. The source encoder is defined in such a way that, 



conditioned on the public message M p , the adversary views 
the source as if it were generated by passing U n through 
a memoryless channel Ps\u- With this perspective, the past 
S 1 ^ 1 will no longer help the adversary; Eve's best strategy 
is to choose a function t that maps Ui to T%. 

Although we omit the full proof of Theorem[4] we provide 
the crucial lemma that shows how the weak secrecy provided 
by a good channel code is used in analyzing the payoff. 
The result of Lemma Q] (below) is that we can view Eve as 
having full knowledge of M p and S l ~ 1 and no knowledge 
of M s , which fulfills our goal of creating a secure channel 
and a public channel. In other words, using channel coding 
to create physical-layer security in the form of a structure Cs 
allows us to show that, from Eve's perspective, knowledge 
of (Z n , S 1-1 ) is no more helpful than (M p , S z ~ 1 ) in easing 
the distortion. To parse the statement of the lemma, simply 
look at the arguments of <(■). 

Lemma 1. If Pm ,m s satisfies for every n, and 
{Pz*\M p ,M.}n=i G C s , then for all e > 0, 



mm J 
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£(i,s 1 — 1 ,m p ) 
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-Y d <S i ,t{i,S i - 1 ,M p )) 
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5(e) 



as e -¥ 0. 



for sufficiently large n, where 5(e) 

Proof: Let e > 0. Introduce the random variable 
Q ~ Unif[l : n], independent of all other random variables 
present. First, we have 

IiSQiZ^MpS^Q) 



1 

-Y^I{S t] Z n \M p S l 



L ) 



i=l 



1 



= -I(S n ;Z n \M„) 
n 

< -I(M s S n ;Z n \M p ) 
n 

= -I(M s ;Z n \M p ) + -I(S n ; Z n \M p M s ) 
n n 

= -I(M s ;Z n \M p ) 
n 

< -I(M s ;Z n ,M p ) 
n 

< e 

for sufficiently large n, where the final inequality follows the 
definition of Cs- Next, denote P — PsQz n M p Q an ^ define 
the distribution 



P — Pm p s < 3- 1 qPsq\ai p sQ- 1 qPz™\m p sQ- 1 q- 

That is, P is the markov chain Sq - MpS^Q- Z" 
using Pinsker's inequality (see ifTTI ). we have 



Now, 



\P -P\\tv < D{P\\P)z 

= I(S Q ;Z n \M p SQ- 1 ,Q)i 



(7) 



where \\P— Q\\tv '■= su Pa \P(A) — Q(A)\ is the variational 
distance between distributions P and Q. Finally, 
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2J, then we join the results. Finally, we use the example to 
illustrate the difference between Theorems Q] and [2] 

Denoting the region in Theorem [3] by 1Z, we have the 
following. 

Theorem 5. For a binary symmetric broadcast channel with 
Py\x = BSC(pi), Pz\x = BSC(p2)» and pi < p 2 , we have 



min E[w(S Q ,t(Q,S Q - 1 ,Z n ,M p ))] 

min Ep[Tr{S Ql t(Q,S Q -\Z n ,M p ))] -5(e)(9) 

s" 1 1 ,z n ,m p ) 

min Ep [Tr(S Q ,t(Q,S Q - 1 ,M p ))] -5(e) (10) 

s* 1 ,m p ) 

min E[7r(S Q ,t(Q,S Q -\M p ))] -26(e) (11) 
1 - 
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s l ~ 1 ,m 



25(e), 



for sufficiently large n. The justification is as follows: 
. (HI): Give Eve M p for free. 

• (O: Change the underlying distribution from P to _P by 
using (0 and Lemma [3] 

• ( [Tol l: Use Lemma |2] since P is a markov chain. 

• (fTTT) : Change the underlying distribution back to P. 

■ 

Lemma 2 (Used in Lemma Q] proof). LeJ X, Y", and Z be 

random variables that form a markov chain X — Y — Z and 
let g be a function on A x Z. Define two sets of functions, 
F = {/ : X x y -> A} and F' = {/ -.y -> A}. TTzen 

minE[ 5 (/(X,r),Z)] - minE[. 9 (/(F),Z)]. 
Proof omitted. 

Lemma 3 (Used in Lemma[T]proof). Lef f(x) be a bounded 
function, and P and Q pmfs on X. Then 

Ep [/(*)] ->E Q [/(*)] as P^UQ 
Proof of Lemma \3} 

E P [f(X)]-E Q [f(X)] 



= ^2(P(x)-Q(x))f(x) 

xEX 



= 2 /max 1 1 -P — Q\\tV- 



IV. Example 

In this section, we give an analytical expression for the 
region in Theorem Q] when the value function tt(s, t) is 
Hamming distance and the broadcast channel is binary sym- 
metric. We first consider the separate regions that we stated 
for source coding and channel coding (i.e., Theorems [3] and 



(Rp, R s ) : 
Rp < 1 - fc(7* px) 

R s < h(-f * px) - /i(7 * pi) - h(pi) + h(p 2 ) J 
where h(-) is the binary entropy function. 

The source coding achievability region in Theorem [4] is 
given as a union of (R p , R S ,H) subregions, one subregion 
for each choice of Pjj\s- However, once Pjj\s is fixed, 
(R p , R s , n) triples on the boundary satisfy R p = H(S) — R S , 
so we restrict our attention to (i? s ,n) pairs. According to 
Theorem |U the boundary is given by 



Tl(R s ) 



H(S\U)=R S 



min E[tt(S, t(U))]. (12) 

t(u) 



When 7r(s, t) is Hamming distance, we give an analytical 
expression for ( fT2l . 

Theorem 6. Fix Ps and let n(s,t) = l/w^i. Define 
the function f(R) as the linear interpolation of the points 
(logn, Sz ^ L ), n = 1,2,... and the function g(R) as the 
constant 1 — max s Pg(s). Then ( 1721 ) is given by 

U H (R s ) = mm(f(R s ),g(R s )). 

We now use Theorems [5] and [6] to give an expression for 
Theorem[T]when the value function is Hamming distance and 
the broadcast channel is binary symmetric. 

Theorem 7. With source Ps, channels Py\x — BSC(pi) 
and Pz\x — BSC(p2), and value function n(s,t) = l{ s ^ t }, 
an achievable payoff is 

'U H {h(l *Pi) - h (l*P2) - h(pi) + h(p 2 )) 
if h(p 2 ) - h(pi) < H(S) <l-h(px) 

n H (H(S)) 

. ifH(S)<h( P2 )-h( Pl ) 



n 



where 7 e [0, |] solves H(S) = l — h(j*p 2 ) — h(p 1 ) + h(p 2 ) 
and TIh{R s ) is as in Theorem® 

Discussion of Theorem [2] 

When we established the lower bound in Theorem Q] we 
did so with the structure of a public channel and secure 
channel in mind; however, as mentioned, the public channel 
may not be truly public. We made the assumption that the 
adversary is freely given M p ; indeed, the proof of Lemma Q] 
illustrates this in ([8]), where we suffer a loss in our payoff 
analysis by including M p as an input to the adversary's 
strategy. 
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Fig. 4. The result of ThmUJwith P5 = Bern(p), pi = 0, and p2 = 
0.3. The "Theorem Q]' curve is directly Thm [7] and "Theorem [2]' is the 
improvement to Thmff] "Unconditional" is the payoff when Eve only knows 
Ps, while "No Encoding" refers to X n = S". 



We can strengthen the analysis of Theorem[TJby taking into 
account the equivocation of the public message. For block- 
length n, the equivocation of the public message vanishes at 
a certain time k due to the adversary's ongoing accumulation 
of past source symbols S k ~ 1 . Before time fc, the payoff 
is il max = min t E[ir(S, t)] (i.e., the unconditional payoff). 
After time fc, the payoff is as in Theorem Q] Denoting this 
payoff by IIi, we can now achieve (Theorem |2]l 



n, 



-n n 



n 



1 



fc 



ni. 



The ratio - is found to be 



fc _ [I(V;Y)-I(V;Z))+ 
n ~ I(S; U) 

Figure [4] shows the difference between Theorem Q] and Theo- 
rem |2j as well as a comparison to the curves that correspond 
to no encoding and unconditional payoff. Unconditional 
payoff refers to the distortion that Eve suffers if her only 
knowledge is the source distribution, and no encoding refers 
to simply taking the source as the input to the channel and 
bypassing the encoder. The example is for a Bernoulli source 
with bias p. If we assume that Eve has full knowledge of 
the public message, then we see that for, say, p = 0.4, the 
distortion guaranteed by the weaker theorem is even worse 
than if no encoding was used. This illustrates the importance 
of Eve's equivocation of the public message. 



Theorem 8. Fix Ps, Pyz\x, an d n(s,t). If a payoff 'IT is 
achievable, then the inequalities 

H(S) < I(W;Y) 
H{S\U) < [I{W; Y\V) - I(W; Z\V)] + 
II < minE[7r(5,t(Z7))] 

t{u) 

must hold for some distribution 

PsPu\sPvPw\vPx\wPyz\x- 

VI. Conclusion 

By considering source and channel operations separately, 
we have given results on how well communication systems 
can perform against a worst-case adversary when the secrecy 
resource is physical-layer security and the adversary has 
causal access to the source. We have seen that a guaran- 
tee of weak secrecy can be used in conjunction with our 
operationally-relevant measure of secrecy. 
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V. Upper Bound 



The upper bound is established by using ideas from the 
converses in [7| and [8|. 



